SOC Engineer - SC Cleared - Inside IR35

JR United Kingdom; Slough; On-site; GBP 50,000 - 70,000; Full time

Job summary

A leading company in the public sector seeks a skilled SOC Engineer to enhance their security operations capabilities. The successful candidate will engage in deploying advanced Microsoft security tools, optimizing alert systems, and supporting threat response strategies within a dynamic team environment.

Qualifications

• Experience with Microsoft Sentinel, Defender, and Azure technologies.
• Hands-on experience in SOC operations and security tooling.
• Ability to implement SOAR playbooks and develop detection logic.

Responsibilities

• Engineer and maintain security tooling including Microsoft Sentinel and Defender solutions.
• Develop detection logic using KQL and implement SOAR playbooks.
• Collaborate with teams to ensure telemetry quality and optimize alert fidelity.

Skills

Microsoft Security Stack

KQL

SOAR playbooks

Microsoft Sentinel

Microsoft Defender

Job description

Social network you want to login/join with:

SOC Engineer - SC Cleared - Inside IR35, Slough

Client:

SR2 | Socially Responsible Recruitment | Certified B Corporation

Location:

Slough, United Kingdom

Job Category:

Other

EU work permit required:

Yes

Job Views:

4

Posted:

10.06.2025

Expiry Date:

25.07.2025

Job Description:

A skilled SOC Engineer is required to support the design, configuration, and optimisation of a mature security operations capability within a critical public sector environment. The successful candidate will be responsible for the deployment, tuning, and continual improvement of advanced detection and response tooling, with a focus on the Microsoft Security Stack and Azure-native technologies.

This is a hands-on engineering role with cross-functional engagement across detection teams, infrastructure, and threat response.

Key Responsibilities

• Engineer and maintain security tooling, including:
• Microsoft Sentinel – connector management, rule tuning, data enrichment
• Microsoft Defender solutions (Endpoint, Identity, Cloud Apps)
• Develop and refine detection logic using KQL, and implement SOAR playbooks via Logic Apps.
• Integrate data sources from hybrid environments (cloud/on-premise) into the SIEM.
• Optimise alert fidelity and reduce false positives through rule refinement and log tuning.
• Support the SOC function by identifying and addressing detection gaps.
• Collaborate with infrastructure and operations teams to ensure telemetry quality and visibility.
• Contribute to engineering playbooks, architectural documentation, and automation pipelines.
• Support threat hunting, red/blue team simulation readiness, and post-incident forensic analysis.